duplicity-team team mailing list archive

[Peter Schuller <peter.schuller@xxxxxxxxxxxx>]

> i just checked on suse linux 11 and it seems that 'e' parameter for 'ps' shows only the environment vars of your own processes.
> It showed nothing when logged in as a different user and duplicity was running as the first user.

Hmmmmm, okay. I'd have to re-check. I did a quick test but didn't
check processes belonging to user users. But I'm pretty sure that I've
read about env variables not being considered safe, for example for
GPG passphrases.

Possibly it depends on OS. Hmmmm.

<googles>

http://lists.gnupg.org/pipermail/gnupg-devel/2003-January/019607.html

It's very very possible this is just changed in practice on Linux
systems. But I'd be surprised if one can strictly count on it. But
certainly I'm sure it's better than passing secrets on the command
line. I did test it on FreeBSD 8 and it seems I cannot see other
user's envs there either.

-- 
/ Peter Schuller

-- 
duplicity shows sensitive data in process listing
https://bugs.launchpad.net/bugs/504423
You received this bug notification because you are a member of
duplicity-team, which is a direct subscriber.

Status in duplicity - Bandwidth Efficient Encrypted Backup: New

Bug description:
If credentials are given in the command line url parameter these show up in 'ps'

e.g.

/usr/bin/duplicity --verbosity 4 --encrypt-key FD3846C2 --sign-key FD3846C2 --gpg-options= --exclude-globbing-filelist /root/.duply/bkp/exclude /backup/ ftp://<user>:<PASSWORT>@<backupserver>/backup

suggestion is to introduce env vars URL_PASSWORD/URL_USERNAME and to keep FTP_PASSWORD for ftp backend only and backward compatibility. The fact that FTP_BACKEND can be used with nearly all backend is afaik not documented. Even so duply 1.5.1.4+ will use it until this bug is resolved.

for the future a config file based auth as mentioned in
http://lists.gnu.org/archive/html/duplicity-talk/2010-01/msg00032.html
could make sense.

.. ede